Method and System for an Integrated Incident Information and Intelligence System

ABSTRACT

Providing a system and method for identifying and characterizing incidents. The system and method can receive information from telecommunications networks or other information providers that may trigger generating an Incident Record. The Incident Record may further be analyzed to characterize the type of incident. This further analysis may include retrieving data from multiple data sources to support the application of rules used to characterize the incident. Additionally, analyses from multiple incidents may be combined if determined to relate to a single event.

CROSS-REFERENCE TO RELATED APPLICATIONS

This application is a continuation of U.S. patent application Ser. No.11/406,722 titled Method and System for an Integrated IncidentInformation and Intelligence System, filed Apr. 19, 2006, which claimspriority under 35 U.S.C. §119 to U.S. Provisional Patent Application No.60/672,701, titled Method and System for an Integrated IncidentInformation and Intelligence System, filed Apr. 19, 2005. The completedisclosure of each of the above-identified applications is hereby fullyincorporated herein by reference.

FIELD OF THE INVENTION

This invention relates to a system and method for integrating incidentinformation and intelligence. More particularly, this invention relatesto evaluating information from telecommunications systems or otherinformation sources indicating that an incident may have occurred andcharacterizing the possible incident.

BACKGROUND OF THE INVENTION

In 1967, the President's Commission on Law Enforcement andAdministration of Justice recommended that a single nationwide number beestablished for reporting emergency situations. Overwhelming support forthe concept prompted AT&T, the nation's predominate telecommunicationscompany at that time, to establish the three-digit number 911 as theemergency code throughout the United States.

Today, nearly every area of North America is covered by basic orenhanced 911 service from landline, also referred to as “wireline,”telecommunications networks. Basic 911 means that when the number isdialed, a call taker in the local public safety answering point (PSAP),or 911 center, answers the call. The caller can communicate the natureand location of the emergency to the call taker who can then take actionas appropriate to dispatch emergency service personnel to the scene.With enhanced 911 (E911), the local 911 center has information andtechnology that allows the call taker to see the caller's phone numberand address on a display. This enhancement enables the center to morequickly dispatch emergency help, even if the caller is unable tocommunicate where they are or the nature of the emergency.

As wireless communications became more popular, the capabilities ofE911, primarily the automated number and location identification (ANIand ALI) capabilities, were extended to wireless callers to enhancepublic safety. As part of this extension, the laws and technology arenow largely in place to enable wireless service providers to locate amobile device to within 100 meters.

When a 911 call is made, the telecommunications switch, whether wirelineor wireless, must know which PSAP should receive the call. Thisdetermination is made based on the location of the caller. From awireline phone, the location is simply determined by using a look-uptable that associates the calling number with an address. For a wirelesscaller, locating the call is more complex. The wireless service providermay use global positioning technology, which is sometimes a part of thephone, or the service provider may use some type of signaling analysisto help pinpoint the location of the caller. The location process may befurther complicated if the call is made from a phone that is moving.

While E911 has greatly enhanced the ability for emergency response teamsto coordinate and react to emergency situations, the system providesmany opportunities for improvements. For example, with more than 4,400PSAPs nationwide, technical as well as institutional challenges oftenmake it difficult to share information about incidents that spanmultiple jurisdictions or even among multiple disciplines within thesame jurisdiction. Most PSAPs and response organizations haveindependent software systems or policies that often makes a coordinatedresponse more difficult. Similarly, situations that routinely spanmultiple jurisdictions, such as “Amber Alerts” and evacuation managementcould be better served by an integrated incident analysis and responsesystem.

In addition to 911 systems, other systems are in place that provideindications of emergency or other incidents. These systems may includestatic sensors, such as traffic sensors; weather alert systems; orindustrial accident warning systems. These systems can be integratedwith 911 and other systems to provide an integrated incident analysissystem.

In view of the foregoing, there is a need for a system and method thatintegrates incident information and intelligence by identifying,analyzing, and characterizing incidents.

SUMMARY OF THE INVENTION

The present invention provides a system and method that integratesincident information and intelligence by identifying, analyzing, andcharacterizing incidents.

In one aspect of the invention, a method running on a computer isprovided. The method includes the steps of: (1) receiving, at thecomputer, an incident record; (2) determining, by the computer, ageographic area associated with the incident record; (3) accessing, bythe computer, a plurality of basic event rules and advanced event rules;(4) retrieving, by the computer, stored data comprising historicalincident event data, dynamic data, and static data, wherein thehistorical incident event data, dynamic data, and static data areassociated with the geographic area associated with the incident record;(5) comparing, by the computer, the historical incident event data to atleast one of the dynamic data and static data; and (6) providing aresult of the comparison.

The aspects of the present invention may be more clearly understood andappreciated from a review of the following detailed description of thedisclosed embodiments and by reference to the drawings and claims.

BRIEF DESCRIPTION OF THE DRAWINGS

FIG. 1 depicts an operating environment of an exemplary embodiment ofthe present invention.

FIG. 2 a presents a block diagram showing components of the IntegratedIncident Information and Intelligence System of an exemplary embodimentof the present invention.

FIG. 2 b presents a block diagram showing components of the IntegratedIncident Information and Intelligence System of an alternative exemplaryembodiment of the present invention.

FIG. 2 c presents a block diagram showing components of the IntegratedIncident Information and Intelligence System of an alternative exemplaryembodiment of the present invention.

FIG. 2 d presents a block diagram showing components of the IntegratedIncident Information and Intelligence System of an alternative exemplaryembodiment of the present invention.

FIG. 3 depicts a wireless telephony component of an operatingenvironment of an exemplary embodiment of the present invention.

FIG. 4 presents an overall process flow diagram of an exemplaryembodiment of the present invention.

FIG. 5 presents a process flow diagram for generating an incident recordas part of an exemplary embodiment of the present invention.

FIG. 6 presents a process flow diagram for performing an initial dataanalysis as part of an exemplary embodiment of the present invention.

FIG. 7 presents a process flow diagram for accessing stored data as partof an exemplary embodiment of the present invention.

FIG. 8 presents a process flow diagram for querying a wireless telephonynetwork as part of an exemplary embodiment of the present invention.

FIG. 9 presents a process flow diagram for a Privacy Module of anexemplary embodiment of the present invention.

DETAILED DESCRIPTION OF THE EXEMPLARY EMBODIMENTS

Exemplary embodiments of the present invention provide a system andmethod for integrating incident information and intelligence byidentifying, analyzing, and characterizing incidents.

FIG. 1 depicts an operating environment 100 of an exemplary embodimentof the present invention. Referring to FIG. 1, an Integrated IncidentInformation and Intelligence System 160 connects to multiple informationsources. These multiple information sources include telecommunicationsnetworks 110, a National Weather Service 120, News and Event Information130, Government Agencies 140, and Data Sensors and Data Analysis Nodes150. These information sources may provide information to the IntegratedIncident Information and Intelligence System 160 that triggers anincident detection and/or they may provide information to support theanalysis of a detected incident, such as a 911 call. The IntegratedIncident Information and Intelligence System 160 also connects to endusers 170, who use the results of an incident analysis performed by theIntegrated Incident Information and Intelligence System 160.

The Telecommunications Networks 110 may include wireline and wirelesstelephony systems. Additionally, the telecommunications networks 110 mayinclude private or specialized telephony systems, such as dedicatedtelephony systems used by private or government facilities. Also, thewireless telephony systems may include multiple wireless carrierssupporting a single area. One skilled in the art would appreciate thatany type of telecommunications network could provide information to theIntegrated Incident Information and Intelligence System 160.

The Telecommunications Networks 110 may provide incident information tothe Integrated Incident Information and Intelligence System 160. Atleast two forms of incident detection may be performed by the IntegratedIncident Information and Intelligence System 160 based on informationfrom telecommunications networks 110. The first form relates primarilyto wireless telephony networks and involves the processing of event datarelating to many types of subscriber, that is, wireless telephony user,events in the network. These events may include call initiation, calltermination, handoffs from one cell to another, and mobile stationregistrations.

This event data is collected for all events in a given region, whetheror not the subscribers use the 911 (or other) emergency services. Ifsubscriber movement can be discerned from the event data, such as bydetermining a subscriber has moved from one cell location to another,the subscriber's movement can be assigned to the most likely roadsegments that facilitate such travel. U.S. Pat. No. 6,842,620, entitledSystem and Method for Providing Traffic Information Using OperationalData of a Wireless Network describes one way that the subscriber'smovement can be assigned to the most likely road segments. Thespecification of U.S. Pat. No. 6,842,620 is hereby fully incorporatedherein by reference.

By tracking a subscriber's movement along a roadway, subsequent incidentdetections can be analyzed in view of this movement. In one example, anincident may be triggered by the characterization of the movement ofmobile stations operating in the wireless telephony network. Toillustrate further, the Integrated Incident Information and IntelligenceSystem 160 may determine that the average speed on a highway suddenlydropped from 60 miles per hour to 10 miles per hour. This change maytrigger an incident detection.

As another example, if a subscriber uses the 911 (or other) emergencyservices, the Integrated Incident Information and Intelligence System160 may characterize the emergency incident based on that subscriber'slocation. Emergency 911 calls performed by seemingly non-movingsubscribers can provide insights as well, especially if they occur atthe same time as those that are moving. In this case, the IntegratedIncident Information and Intelligence System 160 may determine that theincident itself is preventing the non-moving subscribers from moving,such as an automobile accident involving those subscribers.

In this form of incident detection, individual 911 calls may be analyzedin order to identify patterns, provide insights, and to filter out“noisy” data that represents 911 calls unrelated to traffic incidents.Emergency 911 calls from mobile stations that are moving may be talliedand reported on a per-road-segment basis over a specific time interval.Emergency 911 calls from mobile stations that are not moving may also beassociated with specific road segments. However, since these incidentscould very well be unrelated to traffic, they may be tallied andreported separately from those that incidents initiated by moving mobilestations. Additionally, the Integrated Incident Information andIntelligence System 160 can correlate calls from both moving andnon-moving mobile stations that occur in close proximity to each otherin both time and location.

The second form of incident detection is triggered from any emergency911 call, whether from a wireless or wireline telephony network. Anexample of how emergency 911 calls from a wireless telephony network maytrigger an incident detection was described above. For a wireline call,the Integrated Incident Information and Intelligence System 160 maydetermine that multiple emergency 911 calls have been made, perhapsinvolving multiple PSAPs. When the Integrated Incident Information andIntelligence System 160 receives notification of a 911 call, the systemmay initiate a scan of all other 911 calls within a certain radius andtime frame. If the Integrated Incident Information and IntelligenceSystem 160 finds a previous 911 call that matches the given criteria,the call can be categorized with the initial call. The system can be“trained” to look for certain volumes, types, or combinations of 911calls in order to categorize each case. For example, an incident withfive or fewer associated 911 calls from moving vehicles could beclassified as a minor traffic incident. An incident with 25 or more 911calls from mobile stations could be classified as a potentially majortraffic incident. An incident with 10 or more 911 calls from bothwireless and wireline telephony networks could be classified as a fireor weather event.

The National Weather Service 120 provides weather information to theIntegrated Incident Information and Intelligence System 160. Thisinformation can be used to trigger an incident detection (such as aweather alert) or to characterize an incident. For example, multipleemergency 911 calls in an area that is under a tornado warning mayindicate that a tornado has formed. The National Weather Service 120 maybe the service run by the U.S. National Oceanic and AtmosphericAdministration or some other weather reporting service, such aslocalized weather recording facilities. One skilled in the art wouldappreciate that any type of weather reporting service could provideinformation to the Integrated Incident Information and IntelligenceSystem 160.

The News and Event Information Sources 130 also provide information tothe Integrated Incident Information and Intelligence System 160,information that may trigger an incident detection or furthercharacterize a detected incident. For example, the Integrated IncidentInformation and Intelligence System 160 may detect an incident based ona traffic abnormality, such as slow moving traffic. The News and EventInformation Sources 130 may indicate that a certain event may be ongoingnear that location, such as a sporting event or local festival. Thisinformation would be used by the Integrated Incident Information andIntelligence System 160 to characterize the incident. Similarly, newsreports of a roadway hazard could be used by the Integrated IncidentInformation and Intelligence System 160 in characterizing the incident.The News and Event Information Sources 130 may include a variety ofsources, including new reports, community and school calendars ofevents, police scanner reports, and road construction information.

Similarly, Government Agencies 140 may provide information to theIntegrated Incident Information and Intelligence System 160. Forexample, a government agency may issue an “Amber Alert.” The Amber Alertprogram was created to provide early and widespread notification that achild has been abducted and may be in danger of serious bodily harm ordeath. With a description of the child, a vehicle involved, or thesuspected abductor, the public can call 911 to notify officials of asighting. This sighting information when analyzed with anonymousmovement information of mobile devices may show one or more mobiledevices that track movement patterns similar to those derived byanalyzing the sightings. If a statistically significant match is found,movement of the device could continue to be tracked until the child isfound or authorities are satisfied that the device movement wascoincidental. Other examples may be evacuation orders, emergencyreadiness drills, or abnormal events at large government facilities.

The Data Sensors and Data Analysis Nodes 150 may also provideinformation to the Integrated Incident Information and IntelligenceSystem 160. In one example, a community may have a traffic sensor systemin place. These sensors may monitor the speed of traffic at certainlocations. The Integrated Incident Information and Intelligence System160 may use this sensor data to trigger an incident detection or furthercharacterize a detected incident, similar to using traffic datadeveloped from mobile station movement information. Other Data Sensorsand Data Analysis Nodes 150 may include weather-related sensors,environmental sensors, or components of other incident detectionsystems. Again, one skilled in the art would appreciate that any type ofData Sensors and Data Analysis Nodes 150 could provide information tothe Integrated Incident Information and Intelligence System 160.

The End Users 170 may include news services, local and nationalgovernmental agencies, and other, centralized, emergency analysis andresponse organizations. Additionally, End Users 170 may be the generalpublic, perhaps through an incident reporting service provider. EndUsers 170 may be linked to the Integrated Incident Information andIntelligence System 160 through a wide-area network, such as theinternet; another telecommunications network; a dedicated connection; orthe system may reside at the End User's 170 location. A singleIntegrated Incident Information and Intelligence System 160 can supportmultiple End Users 170. One skilled in the art would appreciate thatcertain organizations can be both information sources, such asGovernmental Agencies 140, and End Users 170.

FIG. 2 a presents a block diagram showing components of the IntegratedIncident Information and Intelligence System 160 of an exemplaryembodiment of the present invention. Referring to FIGS. 1 and 2 a, theIntegrated Incident Information and Intelligence System 160 includes aData Extraction Module 210 and a Data Analysis Node 220. The DataExtraction Module 210 and the Data Analysis Node 220 include computerhardware and associated software. The Data Extraction Module 210 and theData Analysis Node 220 are connected such that they can convey data orinstructions to one another. The Data Extraction Module 210 includes aPrivacy Module 240 and the Data Analysis Node 220 may include aSituation Analyzer 230. The functions of the Situation Analyzer 230 andthe Privacy Module 240 are discussed in greater detail below, inconjunction with FIGS. 8 and 9, respectively. One skilled in the artwould appreciate that the Data Extraction Module 210 and the DataAnalysis Node 220 may be co-located on same computer system or at thesame facility or located in separate facilities. Similarly, one skilledin the art would appreciate that either the Data Extraction Module 210or the Data Analysis Node 220 individually may operate on one computersystem or on multiple computer systems at the same facility or locatedin separate facilities.

The exemplary Data Extraction Module 210 and the Data Analysis Node 220provide two general functions. The Data Extraction Module 210 interfaceswith information sources to receive information from those sources. Thisreceipt of information may be continuous, in the sense that theinformation source supplies information to the Data Extraction Module210 at regular intervals or as available.

This receipt may be initiated by the information source, which may pushthe information to the Data Extraction Module 210. Other information mybe received by the Data Extraction Module 210 based on requests from theData Extraction Module 210 to the information source.

The Data Analysis Node 220 processes the information received by theData Extraction Module 210. This processing applies rules to thereceived information to characterize this information. Thischaracterization may trigger additional information needs, such that theData Analysis Node 220 requests the information from specificinformation sources through the Data Extraction Module 210.

FIG. 2 b presents a block diagram showing components of the IntegratedIncident Information and Intelligence System of an alternative exemplaryembodiment of the present invention. Referring to FIGS. 2 a and 2 b, theData Extraction Module 210 may actually be multiple Data ExtractionModules 210 a, 210 b, 210 c, all of which are operably connected to asingle Data Analysis Node 220. Similarly, referring to FIGS. 2 a and 2c, the Data Analysis Node 220 may actually be multiple Data AnalysisNodes 220 a, 220 b, 220 c, all of which are operably connected to asingle Data Extraction Module 210. Finally, referring to FIGS. 2 a and 2d, one or more Data Extraction Modules 210 a . . . 210 n may beconnected to one or more Data Analysis Nodes 220 a . . . 220 n. Thesecomponents may be connected over a local area or wide area network 250,such as the Internet. One skilled in the art would appreciate that thedivision of the Data Extraction Module 210 and the Data Analysis Node220 is a matter of design choice and convenience and that the functionsof the present invention could be performed using a single computersystem and software program. One skilled in the art would alsoappreciate that any Data Extraction Module may include a Privacy Module240 and any Data Analysis Node may include a Situation Analyzer 230.

FIG. 3 depicts a wireless telephony component 300 of an operatingenvironment of an exemplary embodiment of the present invention.Referring to FIG. 3, mobile station (MS) 305 transmits signals to andreceives signals from the radiofrequency transmission tower 310 whilewithin a geographic cell covered by the tower. These cells vary in sizebased on anticipated signal volume. A Base Transceiver System (BTS) 315is used to provide service to mobile subscribers within its cell.Several Base Transceiver Systems are combined and controlled by a BaseStation Controller (BSC) 320 through a connection called the A_(bis)Interface. The Integrated Incident Information and Intelligence System160 can interface with the A_(bis) Interface line. A Mobile SwitchingCenter (MSC) 325 does the complex task of coordinating all the BaseStation Controllers, through the A Interface connection, keeping trackof all active mobile subscribers using the Visitor Location Register(VLR) 340, maintaining the home subscriber records using the HomeLocation Register (HLR) 330, and connecting the mobile subscribers tothe Public Service Telephone Network (PSTN) 345.

In an Enhanced 911 system, the location of a mobile station 305 can bedetermined by embedding a GPS chip in the mobile station 305, or bymeasuring certain signaling characteristics between the mobile station305 and the BTS 315. In either scenario, the process of locating amobile station 305 with the degree of accuracy needed for the Enhanced911 system is managed with a Mobile Positioning System (MPS) 335. TheMPS 335 uses the same network resources that are used to manage andprocess calls, which makes its availability somewhat limited.

The Input Output Gateway (IOG) 350 processes call detail records (CDRs)to facilitate such actions as mobile subscriber billing. The IOG 350receives call-related data from the MSC 325 and can interface with theIntegrated Incident Information and Intelligence System 160.

In the exemplary embodiment of the present invention shown in FIG. 3,the Integrated Incident Information and Intelligence System 160 mayreceive data from a variety of locations in the wireless network. Theselocations include the BSC 320 and its interface, through the A_(bis)Interface, with the BTS 315, MSC 325, the HLR 330, and the MPS 335.

The input communications processes monitor the wireless serviceprovider's network elements and extract the relevant information fromselected fields of selected records. The Integrated Incident Informationand Intelligence System 160 can use data from any network element thatcontains at a minimum the mobile station identifier number, cell ID anda time stamp. Some of the more common data sources are discussed below.

CDRs may be requested from billing distribution centers or thedistribution centers may autonomously send the records via file transferprotocol (FTP). Alternatively the CDRs may be extracted as they areroutinely passed from the IOG 350 to a billing gateway, possiblyutilizing a router that duplicates the packets. The specific method usedwill depend on the equipment and preferences of the wireless serviceprovider.

Handover and Registration messages may be obtained by monitoring theproprietary or standard A-interface signaling between the MSC 325 andthe BSCs 320 that it controls. The Integrated Incident Information andIntelligence System 160 may monitor that signaling directly or it mayobtain signaling information from a signal monitoring system such as aprotocol analyzer. In the latter case the signaling information mayalready be filtered to remove extraneous information. See the discussionin conjunction with FIG. 9, below, of the Privacy process for anexemplary embodiment of the present invention, which removes informationthat may identify the user of a specific mobile station 305.Alternatively, these messages may be extracted from a Base StationManager that continuously monitors message streams on the BTS 315.

FIG. 4 presents an overall process flow 400 of an exemplary embodimentof the present invention. Referring to FIGS. 1, 2 a and 4, at step 410,a Data Extraction Module, such as Data Extraction Module 210,establishes a data link with one or more information sources, such asTelecommunications Networks 110, or one or more other informationsources, such as a National Weather Service 120, News and EventInformation 130, Government Agencies 140, and Data Sensors and DataAnalysis Nodes 150. One skilled in the art would appreciate that thisdata link can be a continuous link constantly maintained between theData Extraction Module 210 and the one or more information sources, aperiodic link established on an as needed basis or a combination of bothcontinuous and periodic connections.

At step 420, the Data Extraction Module 210 generates an IncidentRecord. This step is discussed in greater detail below, in conjunctionwith the discussion of FIG. 5. The Incident Record serves as the inputto the Data Analysis Node 220.

At step 430, a Data Analysis Node, such as Data Analysis Node 220,performs an initial data analysis of the Incident Record. This step isdiscussed in greater detail below, in conjunction with the discussion ofFIG. 6. At step 440, the Data Analysis Node 220 determines if theresults of the initial data analysis triggers a Situational Analyzer,such as Situational Analyzer 230. For example, an initialcharacterization of an incident may determine that an accident hasoccurred at a certain location and that initial characterization maycall for collecting traffic flow data from that location for asubsequent two hours.

If the result of this determination is “YES,” then the process moves tostep 450, where the Situational Analyzer 230 queries the wirelesstelephony network. This step is discussed in greater detail below, inconjunction with the discussion of FIG. 8. From step 450, the process400 moves to step 460, where the Data Analysis Node completes the dataanalysis of the Incident Record. The result of this analysis is anIncident Detector Result, which reflects the characterization of theincident or incidents.

If the result of the determination at step 440 is “NO,” or after step460, then the process 400 moves to step 470, where the Data AnalysisNode presents the results to one or more end users, such as End Users170.

FIG. 5 presents a process flow diagram for the step of generating anincident record 420 as part of an exemplary embodiment of the presentinvention. Referring to FIGS. 2 a, 4, and 5, at step 510, the DataExtraction Module 210 receives information from one or more informationsources. This information may included mobile station information, suchas call initiation (including 911 calls), call termination, handoffsfrom one cell to another, and mobile station registrations, or mobilestation location. This information may also include 911 call initiationand call location from a wireline telephony network. Other informationcould be weather alerts, police activities, traffic sensornotifications, or new alerts.

At step 520, the Data Extraction Module 210 determines if a PrivacyModule, such as Privacy Module 240, should be invoked. If the result ofthis determination is “YES,” process 420 moves to Step 910, which isdescribed below in conjunction with FIG. 9. To help ensure the privacyof wireless telephony network users, an exemplary embodiment may includethe capability, through the Privacy Module, to mask any personalidentifying information from the information received from the wirelesstelephony network and substitute a unique identifier for thisinformation.

If the result of this determination is “NO,” or after the Privacy Modulecomplete its operations, process 420 moves to Step 530, where BasicEvent Rules are accessed. The Basic Event Rules are used to identifycertain events as incidents. These Basic Event Rules may simply includewhether a 911 call was received, whether a news alert has been issued,or whether the received data indicates a traffic flow parameter. Basedon applying these rules to the information received at step 510, theData Extraction Module 210 creates an Incident Record. Once the recordis generated, the process 420 moves to step 430 of process 400, asdepicted in FIG. 4.

FIG. 6 presents a process flow diagram for performing an initial dataanalysis as part of an exemplary embodiment of the present invention.Referring to FIGS. 2 a, 4, and 6, at step 610, a Data Analysis Node,such as Data Analysis Node 220, receives the Incident Record from thedata Extraction Module 210. At step 620, the Data Analysis Node 220accesses Advanced Event Rules. These Advanced Event Rules are used toprovide an initial characterization of the incident in the IncidentRecord. Some representative examples of Advanced Event Rules include:

-   -   If traffic speeds drop by more than 50% and there are 3 or more        911 calls from moving vehicles then characterize the incident as        an accident and continuously track all devices in the area for        the next 2 hours;    -   If 10 or more 911 calls are seen within a 15 minute period        within a 3 mile radius, then continuously track all devices        within a 25 mile radius for the next 4 hours;    -   If system user designates a geographic area as a disaster area,        then characterize that incident as a disaster declaration and        continuously track all devices in the designated area for a user        specified period of time;    -   If multiple 911 calls are seen in adjacent PSAP areas, then        characterize the incident an a multi jurisdictional emergency        and notify all involved PSAPs that there may be related        incidents    -   If the system receives notice of an Amber Alert, then        characterize the incident as a child abduction and continuously        track all devices in a 50 mile radius for the next 12 hours or        during the entire time the Amber Alert is in effect;    -   If severe weather is reported in a given area, then characterize        the incident consistent with the type of weather alert and        continuously track all devices for the duration of the severe        weather warning; and    -   If travel time through a work zone increases by more than 50%        then characterize the incident as a traffic flow abnormality        send a notification to the Department of Transportation or        construction supervisor (allowing them to perhaps facilitate        traffic movement through the area).

At step 630, the Data Analysis Node 220 identifies the geographic areaof interest. At step 640, the Data Analysis Node 220 retrieves storeddata. This step is discussed in greater detail below, in conjunctionwith FIG. 8. Generally, historical data; dynamic data, such as trafficdata, weather data, construction data, calendar data, sensor data, andother similar dynamic data; and static data, such as geographicinformation system (GIS) data, is retrieved at step 630. Thisinformation is combined with advanced event rules to characterize anincident.

At step 650, the Data Analysis Node 220 performs an initial analysis ofthe Incident Record. As one representative example, the Incident Record,which may have originally been based on information from a traffic datasensor, indicates that the speed of traffic at a specific section of aninterstate highway has dropped from 60 miles per hour to 10 miles perhour. The data retrieval step, step 640, indicates that, at thatspecific geographic location there is no construction. Historical dataindicates that at that time and day, traffic should be moving 60 mph.Weather information indicates that there is no inclement weather.Calendar event information does not indicate any events that wouldimpact traffic at that location. As a result of applying the AdvancedEvent Rules to these data, the Data Analysis Node may initiallycharacterize the incident as a traffic accident.

At step 660, the Data Analysis Node 220 stores the incident analysis asan Incident Detector Result. Information that may be stored includes acase number, the type of Incident Record, the preliminary categorizationof the incident, a time stamp, and a location. Other information thatmay be stored if the incident record is based on information about amobile station includes an anonymous identifier for the mobile station,an indication of whether the mobile station is moving, and if so, theroad segment location and direction and speed of movement.

At step 670, the Data Analysis Node 220 determines if thecharacterization of the incident determined at step 650 requires afurther analysis of other, possibly related, Incident Records. If theresults of this determination is “YES,” the process 430 moves to step680 where it searches the stored Incident Detector Results for otherincidents at nearby locations and at the same time. Expanding on theexample discussed above in conjunction with step 650, the Data AnalysisNode 220 would search the stored records to determine of other incidentsoccurred near that highway segment near the same time as the incidentthat recorded the slow-down of traffic speed. This search may findadditional Incident Detector Results, such as 911 calls made from mobilestations at that location and time.

After the additional Incident Detector Results are retrieved, theprocess 430 returns to step 650 for further analysis. The results ofthis further analysis may be a new grouping of multiple incidents into asingle Incident Detector Result. To continue with the example, a newcase number may be associated with the traffic slow-down incident andone or more 911 calls. The analysis may conclude that a traffic accidenthas occurred at that highway location.

In some cases, the Data Analysis Node 220 may not be able tocharacterize the Incident Record until other Incident Records areevaluated or subsequent information is obtained.

If the results of the determination at step 670 is “NO,” the process 430moves to step 690, where it returns to step 440 of process 400.

FIG. 7 presents a process flow diagram for accessing stored data as partof an exemplary embodiment of the present invention. Referring to FIGS.2 a, 6, and 7, at step 710, the Data Analysis Node 220 retrieveshistorical incident data. These data may be previously-stored IncidentDetector Results. Additionally, these data may include historicalsummaries. For example, these summaries may provide general trendinformation such as traffic speeds for certain days and times or annualevents.

At step 720, the Data Analysis Node 220 retrieves dynamic data notassociated with a wireless telephony network. That is, these data wouldnot include movement information for mobile stations. These data mayinclude weather information, news information, calendar eventinformation (school schedules, sporting events, festivals, conventions,etc.), sensor information, road construction plans, and governmentalagency alerts.

At step 730, the Data Analysis Node 220 retrieves static data. Thesedata may include information from a geographic information system andmay include the locations of event venues, roadways, and companies withlarge numbers of employees.

At step 740, the Data Analysis Node 220 determines if other data sourcesshould be queried. These other data sources may include other DataExtraction Modules or third-party sources such as private employers. Ifthe result of this determination is “YES,” then the process 640 moves tostep 750 and the Data Analysis Node 220 retrieves the additional data.If the result of this determination is “NO,” or after the additionaldata is retrieved, the process 640 moves to step 760, where it returnsto process 430 at step 650.

FIG. 8 presents a process flow diagram for querying a wireless telephonynetwork as part of an exemplary embodiment of the present invention.Referring to FIGS. 2 a, 4, and 8, at step 810, a Situation Analyzer 230identifies mobile station for obtaining additional information. Forexample, the results of step 430 may indicate that a mobile station on aroad segment has stopped. The Situation Analyzer 230 will determineother mobile stations near that location moving in the same direction asthe mobile station that appears to be stopped. This information may bestored as Incident Detector Results or stored independently as trafficdata.

At step 820, the Situation Analyzer 230 contacts the Privacy Module 240and extracts user-specific information about the identified mobilestations. At step 830, the Situation Analyzer 230 sends a request to thewireless telephony network for the location, as determined by thenetwork's mobile positioning system, of each mobile station identifiedin step 810.

At step 840, the Situation Analyzer 230 receives the location data fromthe network's MPS. At step 850, The Situation Analyzer 230 determines ifthe Privacy Module 240 should be invoked to mask any personalidentifying information. If the result of this determination is “YES,”process 450 moves to Step 910, which is described below in conjunctionwith FIG. 9. If the result of this determination is “NO,” or after thePrivacy Module complete its operations, process 450 moves to Step 860,where it returns to process 400 at step 460.

FIG. 9 presents a process flow diagram for a Privacy Module of anexemplary embodiment of the present invention. Referring to FIG. 9, atstep 910, the Privacy Module 240 receives communication information. Atstep 920, the Privacy Module 240 looks up a Communication UnitIdentifier associated with the communications information in a database.This Identifier may be the serial number or phone number of a mobilestation. The database includes all Communication Unit Identifiersprocessed by the Privacy Module 240. This database may be purgedperiodically, such as when a record is more than 24 hours old, toprovide an extra measure of privacy.

Alternatively, this database may be maintained for long periods of time.Historical anonymous movement analysis could be very useful ininvestigative activities, especially when the investigation involvesserial offenses. For example, if a similar crime occurs in severaldifferent locations, the movement data maintained in the IncidentDetector Results database, or other traffic-information-specificdatabase, could be analyzed to determine if any mobile devices werepresent at a statistically significant number of these locations at thetimes the crimes were committed.

Another example of how anonymous movement data could be useful for lawenforcement officials is when the anonymous movement is overlaid withthe movement of a known suspected terrorist or criminal. If there is astatistically significant correlation between an anonymous mover and theknown suspect, then that may be sufficient reason to suspect that thereis collaboration between the two.

If there is sufficient evidence to suggest that the anonymous mobiledevice may belong to a suspect such as in one of the examples above,then law enforcement agencies could obtain proper authorization tounveil the identity of the owner of the device. In that case, thePrivacy Module 240 database could be accessed to unmask the anonymousmobile station. Even without the identity, the device could be flaggedto monitor and alert authorities if there is any further suspiciousmovement. This type of application may justify maintaining the PrivacyModule 240 database.

At step 930, the Privacy Module 240 determines if the Communication UnitIdentifier is in the database. If the result of this determination is“NO,” then the Privacy Module 240 creates, at step 940, a uniqueidentifier to map to the Communication Unit Identifier and bothidentifiers are stored in Privacy Module 240 database. This uniqueidentifier could be a serial number, the results of an encryptionalgorithm, or other process for mapping a unique identifier with theCommunication Unit Identifier. If the result of this determination is“YES,” or after step 940 is complete, the Privacy Module 240 retrieves,at step 950, the unique identifier for the communications unit. Thefurther processing of the information uses the unique identifier ratherthan the personal identifying information. The Privacy Module 240 thenmoves to step 960, where it returns to the process that invoked thePrivacy Module 240.

In some cases, the information source may apply it own processes to maskpersonal identifying information. For example, a wireless telephonynetwork may mask personal identifying information prior to conveying theinformation to the Data Extraction Module 210, such as by having asystem that strips this information behind the network's firewall.Alternatively, the data source could contract with a separate dataaggregator that supplies the information to the Data Extraction Module210, after personal identifying information was removed.

In view of the foregoing, one would appreciate that the presentinvention supports a system and method for identifying, characterizing,and reporting incidents. The system and method can receive informationfrom telecommunications networks or other information providers that maytrigger generating an Incident Record. The Incident Record may furtherbe analyzed to characterize the type of incident. This further analysismay include retrieving data from multiple data sources to support theapplication of rules used to characterize the incident. Additionally,analyses from multiple incidents may be combined if determined to relateto a single event.

What is claimed is:
 1. A method running on a computer comprising thesteps of: receiving, at the computer, an incident record; determining,by the computer, a geographic area associated with the incident record;accessing, by the computer, a plurality of basic event rules andadvanced event rules; retrieving, by the computer, stored datacomprising historical incident event data, dynamic data, and staticdata, wherein the historical incident event data, dynamic data, andstatic data are associated with the geographic area associated with theincident record; comparing, by the computer, the historical incidentevent data to at least one of the dynamic data and static data; andproviding a result of the comparison.
 2. The method of claim 1 whereinthe step of retrieving, by the computer, stored data further comprisesretrieving data from third party sources.
 3. The method of claim 1,wherein the result comprises an characterization of the incident.
 4. Themethod of claim 3, wherein the result comprises a recommendation of anaction resulting from the characterization.
 5. The method of claim 1wherein the dynamic data comprises data from data sensors.
 6. The methodof claim 1 wherein the dynamic data comprises data from a first datasource comprising a wireless telecommunications network and a seconddata source comprising a source other than a wireless telecommunicationsnetwork.
 7. The method of claim 6 wherein the second data sourcecomprising a source other than a wireless telecommunications networkcomprises one of a weather information source, a news informationsource, or a calendar event information source.
 8. The method of claim 1further comprising the step of applying, by the computer, a situationanalyzer to obtain additional data from one or more mobile stationsprior to performing the step of providing a result.
 9. The method ofclaim 8 wherein the step of applying a situation analyzer to obtainadditional data from one or more mobile stations comprise the steps of:identifying one or more mobile stations for obtaining additional data;and receiving available location data for each identified mobilestation.
 10. The method of claim 9 wherein the step of receivingavailable location data for each identified mobile station is inresponse to sending a location request to each identified mobilestation.
 11. The method of claim 9 further comprising the step ofextracting user-specific information from a privacy database.
 12. Themethod of claim 8 wherein the applying step is triggered based on theresult of the comparing step.
 13. The method of claim 1 wherein thecomparing step comprises applying event rules.
 14. The method of claim13 wherein the event rules comprise basic event rules and advanced eventrules.